diff --git a/monitoring/logging/fluentd/kubernetes/README.md b/monitoring/logging/fluentd/kubernetes/README.md
index c5b6868..dc5616b 100644
--- a/monitoring/logging/fluentd/kubernetes/README.md
+++ b/monitoring/logging/fluentd/kubernetes/README.md
@@ -92,10 +92,17 @@ kubectl apply -f .\monitoring\logging\fluentd\kubernetes\fluentd-configmap.yaml
 Let's deploy our `daemonset`:
 
 ```
-kubectl apply -f .\monitoring\logging\fluentd\kubernetes\fluentd-rbac.yaml 
 kubectl apply -f .\monitoring\logging\fluentd\kubernetes\fluentd.yaml
-
 kubectl -n fluentd get pods
+
+```
+
+Let's deploy our example app that writes logs to `stdout`
+
+```
+kubectl apply -f .\monitoring\logging\fluentd\kubernetes\counter.yaml
+kubectl get pods
+
 ```
 
 ## Demo ElasticSearch and Kibana
diff --git a/monitoring/logging/fluentd/kubernetes/fluentd-configmap.yaml b/monitoring/logging/fluentd/kubernetes/fluentd-configmap.yaml
index da49d27..20beced 100644
--- a/monitoring/logging/fluentd/kubernetes/fluentd-configmap.yaml
+++ b/monitoring/logging/fluentd/kubernetes/fluentd-configmap.yaml
@@ -11,8 +11,8 @@ data:
     # This source gets all logs from local docker host
     @include pods-kind-fluent.conf
     #@include pods-fluent.conf
-    #@include file-fluent.conf
-    @include elastic-fluent.conf
+    @include file-fluent.conf
+    #@include elastic-fluent.conf
   pods-kind-fluent.conf: |-
     <source>
       @type tail
@@ -54,6 +54,18 @@ data:
         time_format %Y-%m-%dT%H:%M:%S.%NZ
       </parse>
     </source>
+
+    <filter kubernetes.**>
+      @type kubernetes_metadata
+      @id filter_kube_metadata
+      kubernetes_url "#{ENV['FLUENT_FILTER_KUBERNETES_URL'] || 'https://' + ENV.fetch('KUBERNETES_SERVICE_HOST') + ':' + ENV.fetch('KUBERNETES_SERVICE_PORT') + '/api'}"
+      verify_ssl "#{ENV['KUBERNETES_VERIFY_SSL'] || true}"
+      ca_file "#{ENV['KUBERNETES_CA_FILE']}"
+      skip_labels "#{ENV['FLUENT_KUBERNETES_METADATA_SKIP_LABELS'] || 'false'}"
+      skip_container_metadata "#{ENV['FLUENT_KUBERNETES_METADATA_SKIP_CONTAINER_METADATA'] || 'false'}"
+      skip_master_url "#{ENV['FLUENT_KUBERNETES_METADATA_SKIP_MASTER_URL'] || 'false'}"
+      skip_namespace_metadata "#{ENV['FLUENT_KUBERNETES_METADATA_SKIP_NAMESPACE_METADATA'] || 'false'}"
+    </filter>
   file-fluent.conf: |-
     <match **>
       @type file
diff --git a/monitoring/logging/fluentd/kubernetes/fluentd-rbac.yaml b/monitoring/logging/fluentd/kubernetes/fluentd-rbac.yaml
deleted file mode 100644
index 2dff202..0000000
--- a/monitoring/logging/fluentd/kubernetes/fluentd-rbac.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: fluentd
-  namespace: fluentd
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: fluentd
-  namespace: fluentd
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - namespaces
-  verbs:
-  - get
-  - list
-  - watch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: fluentd
-roleRef:
-  kind: ClusterRole
-  name: fluentd
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-- kind: ServiceAccount
-  name: fluentd
-  namespace: fluentd
\ No newline at end of file
diff --git a/monitoring/logging/fluentd/kubernetes/fluentd.yaml b/monitoring/logging/fluentd/kubernetes/fluentd.yaml
index 93ed971..cf9bdae 100644
--- a/monitoring/logging/fluentd/kubernetes/fluentd.yaml
+++ b/monitoring/logging/fluentd/kubernetes/fluentd.yaml
@@ -17,8 +17,6 @@ spec:
         k8s-app: fluentd-logging
         version: v1
     spec:
-      serviceAccount: fluentd
-      serviceAccountName: fluentd
       tolerations:
       - key: node-role.kubernetes.io/master
         effect: NoSchedule